open-webui (PyPI)
Advisories
329
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 0.11.1 or later clears every advisory below that has a fix.
Upgrade commands
pip
pip install --upgrade "open-webui>=0.11.1"poetry
poetry add "open-webui>=0.11.1"uv
uv add "open-webui>=0.11.1"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-wvm9-9g5j-623f Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange |
Medium EPSS 0.37% |
>= 0.8.0, < 0.11.1 | 0.11.1 |
| GHSA-wvm9-9g5j-623f Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange |
Medium EPSS 0.37% |
>= 0.8.0, < 0.11.1 | 0.11.1 |
| GHSA-4qg5-cxx4-g927 Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange |
Medium EPSS 0.37% |
>= 0.8.0, < 0.9.0 | 0.9.0 |
| GHSA-4qg5-cxx4-g927 Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange |
Medium EPSS 0.37% |
>= 0.8.0, < 0.9.0 | 0.9.0 |
| GHSA-jqhh-cjmq-vmv6 Open WebUI: Any authenticated user can hang the server via a cyclic chat message history |
Medium EPSS 0.58% |
>= 0.5.0, < 0.11.1 | 0.11.1 |
| GHSA-jqhh-cjmq-vmv6 Open WebUI: Any authenticated user can hang the server via a cyclic chat message history |
Medium EPSS 0.58% |
>= 0.5.0, < 0.11.1 | 0.11.1 |
| GHSA-5x7x-4c3c-qf5w Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets |
Medium EPSS 0.38% |
>= 0.9.5, < 0.11.1 | 0.11.1 |
| GHSA-5x7x-4c3c-qf5w Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets |
Medium EPSS 0.38% |
>= 0.9.5, < 0.11.1 | 0.11.1 |
| GHSA-3cgp-3cqx-j8w2 Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree |
Medium EPSS 0.59% |
>= 0.10.0, < 0.11.1 | 0.11.1 |
| GHSA-3cgp-3cqx-j8w2 Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree |
Medium EPSS 0.59% |
>= 0.10.0, < 0.11.1 | 0.11.1 |
| GHSA-34r3-9m95-vq73 Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch |
High EPSS 0.36% |
< 0.11.1 | 0.11.1 |
| GHSA-34r3-9m95-vq73 Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch |
High EPSS 0.36% |
< 0.11.1 | 0.11.1 |
| GHSA-2724-6cpj-gf3v Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion |
High EPSS 0.49% |
>= 0.10.0, < 0.11.1 | 0.11.1 |
| GHSA-2724-6cpj-gf3v Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion |
High EPSS 0.49% |
>= 0.10.0, < 0.11.1 | 0.11.1 |
| GHSA-3pf7-q2g3-wj28 Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions |
Medium EPSS 0.37% |
>= 0.10.0, < 0.11.1 | 0.11.1 |
| GHSA-3pf7-q2g3-wj28 Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions |
Medium EPSS 0.37% |
>= 0.10.0, < 0.11.1 | 0.11.1 |
| GHSA-4v28-j6q3-5m4r Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader |
High EPSS 0.35% |
>= 0.9.6, < 0.11.1 | 0.11.1 |
| GHSA-4v28-j6q3-5m4r Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader |
High EPSS 0.35% |
>= 0.9.6, < 0.11.1 | 0.11.1 |
| GHSA-jmc6-2wr8-h3wj Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin |
High EPSS 0.42% |
>= 0.8.11, < 0.11.1 | 0.11.1 |
| GHSA-jmc6-2wr8-h3wj Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin |
High EPSS 0.42% |
>= 0.8.11, < 0.11.1 | 0.11.1 |
| GHSA-fmqh-xp37-5hr8 Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint |
Medium EPSS 0.37% |
>= 0.9.5, < 0.11.1 | 0.11.1 |
| GHSA-fmqh-xp37-5hr8 Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint |
Medium EPSS 0.37% |
>= 0.9.5, < 0.11.1 | 0.11.1 |
| GHSA-pcvc-8vrv-8q6w Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends |
Medium EPSS 0.37% |
>= 0.7.0, < 0.11.1 | 0.11.1 |
| GHSA-pcvc-8vrv-8q6w Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends |
Medium EPSS 0.37% |
>= 0.7.0, < 0.11.1 | 0.11.1 |
| GHSA-wpmr-8h3q-fwj7 Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite |
High EPSS 0.60% |
>= 0.6.41, < 0.11.1 | 0.11.1 |
| GHSA-wpmr-8h3q-fwj7 Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite |
High EPSS 0.60% |
>= 0.6.41, < 0.11.1 | 0.11.1 |
| GHSA-p78m-89r6-pgf7 Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication |
Medium EPSS 0.48% |
>= 0.6.27, < 0.11.1 | 0.11.1 |
| GHSA-p78m-89r6-pgf7 Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication |
Medium EPSS 0.48% |
>= 0.6.27, < 0.11.1 | 0.11.1 |
| GHSA-wjwr-xfp9-r66p Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes |
Medium EPSS 0.51% |
>= 0.9.0, < 0.11.1 | 0.11.1 |
| GHSA-wjwr-xfp9-r66p Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes |
Medium EPSS 0.51% |
>= 0.9.0, < 0.11.1 | 0.11.1 |
| GHSA-8r35-5x5r-hv74 Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle |
Medium EPSS 0.48% |
>= 0.10.0, < 0.11.1 | 0.11.1 |
| GHSA-8r35-5x5r-hv74 Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle |
Medium EPSS 0.48% |
>= 0.10.0, < 0.11.1 | 0.11.1 |
| GHSA-v39v-59xw-j98g Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value |
Medium EPSS 0.48% |
>= 0.9.0, < 0.11.1 | 0.11.1 |
| GHSA-v39v-59xw-j98g Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value |
Medium EPSS 0.48% |
>= 0.9.0, < 0.11.1 | 0.11.1 |
| GHSA-3g9q-v48f-hh9w Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout |
High EPSS 0.64% |
>= 0.9.0, < 0.11.1 | 0.11.1 |
| GHSA-3g9q-v48f-hh9w Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout |
High EPSS 0.64% |
>= 0.9.0, < 0.11.1 | 0.11.1 |
| GHSA-3cg5-48j3-v4gv Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder |
High EPSS 0.55% |
>= 0.10.0, < 0.11.0 | 0.11.0 |
| GHSA-3cg5-48j3-v4gv Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder |
High EPSS 0.55% |
>= 0.10.0, < 0.11.0 | 0.11.0 |
| GHSA-2f54-p244-32q6 Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically |
Medium EPSS 0.59% |
>= 0.9.6, < 0.11.0 | 0.11.0 |
| GHSA-2f54-p244-32q6 Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically |
Medium EPSS 0.59% |
>= 0.9.6, < 0.11.0 | 0.11.0 |
| GHSA-pwxh-7358-jq2x Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages |
Medium EPSS 0.40% |
>= 0.10.0, < 0.11.0 | 0.11.0 |
| GHSA-pwxh-7358-jq2x Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages |
Medium EPSS 0.40% |
>= 0.10.0, < 0.11.0 | 0.11.0 |
| GHSA-3r7g-q6cg-q2vx Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints |
Medium EPSS 0.48% |
< 0.11.0 | 0.11.0 |
| GHSA-3r7g-q6cg-q2vx Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints |
Medium EPSS 0.48% |
< 0.11.0 | 0.11.0 |
| GHSA-5gpj-vj23-vhhv Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check |
Medium EPSS 0.28% |
>= 0.8.8, < 0.11.0 | 0.11.0 |
| GHSA-5gpj-vj23-vhhv Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check |
Medium EPSS 0.28% |
>= 0.8.8, < 0.11.0 | 0.11.0 |
| GHSA-73cq-mcgh-379c Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing |
Medium EPSS 0.57% |
>= 0.9.0, < 0.11.0 | 0.11.0 |
| GHSA-73cq-mcgh-379c Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing |
Medium EPSS 0.57% |
>= 0.9.0, < 0.11.0 | 0.11.0 |
| GHSA-h6x2-583h-x99r Open WebUI: DNS Rebinding SSRF Bypass |
Medium EPSS 0.25% |
< 0.11.0 | 0.11.0 |
| GHSA-h6x2-583h-x99r Open WebUI: DNS Rebinding SSRF Bypass |
Medium EPSS 0.25% |
< 0.11.0 | 0.11.0 |
| GHSA-6xhv-rxhv-pwm4 Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata |
Medium EPSS 0.42% |
>= 0.8.8, < 0.11.0 | 0.11.0 |
| GHSA-6xhv-rxhv-pwm4 Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata |
Medium EPSS 0.42% |
>= 0.8.8, < 0.11.0 | 0.11.0 |
| GHSA-jxc9-xmc4-gr23 Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup |
Medium EPSS 0.37% |
>= 0.9.6, < 0.11.0 | 0.11.0 |
| GHSA-jxc9-xmc4-gr23 Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup |
Medium EPSS 0.37% |
>= 0.9.6, < 0.11.0 | 0.11.0 |
| GHSA-3xpf-xq7r-v8c5 Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin |
Medium EPSS 0.38% |
>= 0.9.0, < 0.11.0 | 0.11.0 |
| GHSA-3xpf-xq7r-v8c5 Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin |
Medium EPSS 0.38% |
>= 0.9.0, < 0.11.0 | 0.11.0 |
| GHSA-8x5v-cpv7-8jjp Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs |
High EPSS 0.35% |
>= 0.9.0, < 0.11.0 | 0.11.0 |
| GHSA-8x5v-cpv7-8jjp Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs |
High EPSS 0.35% |
>= 0.9.0, < 0.11.0 | 0.11.0 |
| GHSA-g423-grf7-98rv Open WebUI: Users denied the image-generation permission can still generate images via chat completions |
Medium EPSS 0.41% |
>= 0.7.0, < 0.11.0 | 0.11.0 |
| GHSA-g423-grf7-98rv Open WebUI: Users denied the image-generation permission can still generate images via chat completions |
Medium EPSS 0.41% |
>= 0.7.0, < 0.11.0 | 0.11.0 |
| GHSA-rffm-9q57-q649 Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering |
Medium EPSS 0.35% |
>= 0.6.34, < 0.11.0 | 0.11.0 |
| GHSA-rffm-9q57-q649 Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering |
Medium EPSS 0.35% |
>= 0.6.34, < 0.11.0 | 0.11.0 |
| GHSA-3vf6-64vr-3g56 Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint |
Medium EPSS 0.46% |
>= 0.9.6, < 0.11.0 | 0.11.0 |
| GHSA-3vf6-64vr-3g56 Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint |
Medium EPSS 0.46% |
>= 0.9.6, < 0.11.0 | 0.11.0 |
| GHSA-rq84-p6rr-vf89 Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client |
High EPSS 0.57% |
>= 0.8.0, < 0.11.0 | 0.11.0 |
| GHSA-rq84-p6rr-vf89 Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client |
High EPSS 0.57% |
>= 0.8.0, < 0.11.0 | 0.11.0 |
| GHSA-mj5r-jf49-m3w7 Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages |
Medium EPSS 0.43% |
>= 0.5.0, < 0.11.0 | 0.11.0 |
| GHSA-mj5r-jf49-m3w7 Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages |
Medium EPSS 0.43% |
>= 0.5.0, < 0.11.0 | 0.11.0 |
| GHSA-w2rx-84hp-gg95 Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader |
High EPSS 0.47% |
>= 0.9.6, < 0.11.0 | 0.11.0 |
| GHSA-w2rx-84hp-gg95 Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader |
High EPSS 0.47% |
>= 0.9.6, < 0.11.0 | 0.11.0 |
| GHSA-x2ff-v5v8-m75m Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids) |
High EPSS 0.48% |
>= 0.9.5, < 0.10.0 | 0.10.0 |
| GHSA-x2ff-v5v8-m75m Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids) |
High EPSS 0.48% |
>= 0.9.5, < 0.10.0 | 0.10.0 |
| GHSA-frvj-c5qp-xj4w open-webui terminal proxy path traversal guard bypass via 9x encoded traversal |
High EPSS 0.48% |
>= 0.9.6, < 0.10.0 | 0.10.0 |
| GHSA-frvj-c5qp-xj4w open-webui terminal proxy path traversal guard bypass via 9x encoded traversal |
High EPSS 0.48% |
>= 0.9.6, < 0.10.0 | 0.10.0 |
| GHSA-gmfw-g93r-vg53 Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave) |
Medium EPSS 0.36% |
>= 0.6.16, < 0.10.0 | 0.10.0 |
| GHSA-gmfw-g93r-vg53 Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave) |
Medium EPSS 0.36% |
>= 0.6.16, < 0.10.0 | 0.10.0 |
| GHSA-rqj7-6wrp-6g2g Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission |
Medium EPSS 0.42% |
>= 0.8.11, < 0.10.0 | 0.10.0 |
| GHSA-rqj7-6wrp-6g2g Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission |
Medium EPSS 0.42% |
>= 0.8.11, < 0.10.0 | 0.10.0 |
| GHSA-mvx4-532p-xfm9 Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation |
Medium EPSS 0.53% |
>= 0.9.0, < 0.10.0 | 0.10.0 |
| GHSA-mvx4-532p-xfm9 Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation |
Medium EPSS 0.53% |
>= 0.9.0, < 0.10.0 | 0.10.0 |
| GHSA-m3qf-58wf-w979 Open WebUI: Arena task endpoints can bypass underlying model access controls |
Medium EPSS 0.37% |
>= 0.8.12, < 0.10.0 | 0.10.0 |
| GHSA-m3qf-58wf-w979 Open WebUI: Arena task endpoints can bypass underlying model access controls |
Medium EPSS 0.37% |
>= 0.8.12, < 0.10.0 | 0.10.0 |
| GHSA-j657-m4c4-24jq Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection) |
High EPSS 0.39% |
< 0.10.0 | 0.10.0 |
| GHSA-j657-m4c4-24jq Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection) |
High EPSS 0.39% |
< 0.10.0 | 0.10.0 |
| GHSA-qg3f-8x3j-ggf2 Open WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter bypassable via URL path and non-label-boundary matching |
Medium EPSS 0.38% |
< 0.10.0 | 0.10.0 |
| GHSA-qg3f-8x3j-ggf2 Open WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter bypassable via URL path and non-label-boundary matching |
Medium EPSS 0.38% |
< 0.10.0 | 0.10.0 |
| GHSA-gh7p-78x6-jw6m Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials |
Medium EPSS 0.46% |
>= 0.7.0, < 0.10.0 | 0.10.0 |
| GHSA-gh7p-78x6-jw6m Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials |
Medium EPSS 0.46% |
>= 0.7.0, < 0.10.0 | 0.10.0 |
| GHSA-ffpj-xv5c-p3gw Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config |
Medium EPSS 0.57% |
>= 0.9.2, < 0.10.0 | 0.10.0 |
| GHSA-ffpj-xv5c-p3gw Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config |
Medium EPSS 0.57% |
>= 0.9.2, < 0.10.0 | 0.10.0 |
| GHSA-855v-hq7w-jmjw Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout |
High EPSS 0.55% |
>= 0.9.0, < 0.10.0 | 0.10.0 |
| GHSA-855v-hq7w-jmjw Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout |
High EPSS 0.55% |
>= 0.9.0, < 0.10.0 | 0.10.0 |
| GHSA-7rw5-9f7q-xj36 Open WebUI: Account enumeration via observable login timing discrepancy |
Medium EPSS 0.41% |
< 0.10.0 | 0.10.0 |
| GHSA-7rw5-9f7q-xj36 Open WebUI: Account enumeration via observable login timing discrepancy |
Medium EPSS 0.41% |
< 0.10.0 | 0.10.0 |
| GHSA-7r7x-gjvr-448g Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB) |
Medium EPSS 0.37% |
< 0.10.0 | 0.10.0 |
| GHSA-7r7x-gjvr-448g Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB) |
Medium EPSS 0.37% |
< 0.10.0 | 0.10.0 |
| GHSA-74h3-cxq7-vc5q Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id |
Critical EPSS 0.45% |
< 0.10.0 | 0.10.0 |
| GHSA-74h3-cxq7-vc5q Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id |
Critical EPSS 0.45% |
< 0.10.0 | 0.10.0 |
| GHSA-73x5-h92w-xc2j Open WebUI: Private channel messages can be disclosed through cross-channel thread parent_id binding |
Low EPSS 0.32% |
< 0.10.0 | 0.10.0 |
| GHSA-73x5-h92w-xc2j Open WebUI: Private channel messages can be disclosed through cross-channel thread parent_id binding |
Low EPSS 0.32% |
< 0.10.0 | 0.10.0 |
| GHSA-4r2p-27mh-5m22 Open WebUI: Stored web worker XSS via Pyodide |
Critical EPSS 0.42% |
< 0.10.0 | 0.10.0 |
| GHSA-4r2p-27mh-5m22 Open WebUI: Stored web worker XSS via Pyodide |
Critical EPSS 0.42% |
< 0.10.0 | 0.10.0 |
| GHSA-3wp3-xxj9-5jqq Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse) |
Medium EPSS 0.37% |
>= 0.6.27, < 0.10.0 | 0.10.0 |
| GHSA-3wp3-xxj9-5jqq Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse) |
Medium EPSS 0.37% |
>= 0.6.27, < 0.10.0 | 0.10.0 |
| GHSA-2xwm-4h2q-ggfx Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete |
Medium EPSS 0.42% |
>= 0.9.6, < 0.10.0 | 0.10.0 |
| GHSA-2xwm-4h2q-ggfx Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete |
Medium EPSS 0.42% |
>= 0.9.6, < 0.10.0 | 0.10.0 |
| GHSA-8788-j68r-3cgh Open WebUI: Any authenticated user can read other users' private notes via Socket.IO |
Medium EPSS 0.35% |
< 0.8.11 | 0.8.11 |
| GHSA-8788-j68r-3cgh Open WebUI: Any authenticated user can read other users' private notes via Socket.IO |
Medium EPSS 0.35% |
< 0.8.11 | 0.8.11 |
| GHSA-9rpj-v7hf-vv2w Open WebUI: Authenticated users can target arbitrary configured Ollama backends via unguarded url_idx path parameter |
Medium EPSS 0.28% |
< 0.9.6 | 0.9.6 |
| GHSA-9rpj-v7hf-vv2w Open WebUI: Authenticated users can target arbitrary configured Ollama backends via unguarded url_idx path parameter |
Medium EPSS 0.28% |
< 0.9.6 | 0.9.6 |
| GHSA-p5cp-r7rg-qpxc Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode |
Medium EPSS 0.39% |
< 0.9.6 | 0.9.6 |
| GHSA-p5cp-r7rg-qpxc Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode |
Medium EPSS 0.39% |
< 0.9.6 | 0.9.6 |
| GHSA-jrfp-m64g-pcwv Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirects |
High EPSS 0.39% |
< 0.9.6 | 0.9.6 |
| GHSA-jrfp-m64g-pcwv Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirects |
High EPSS 0.39% |
< 0.9.6 | 0.9.6 |
| GHSA-r2wg-2mcr-66rv Open WebUI: Path traversal / SSRF in terminal server proxy via encoded path traversal |
High EPSS 0.52% |
< 0.9.6 | 0.9.6 |
| GHSA-r2wg-2mcr-66rv Open WebUI: Path traversal / SSRF in terminal server proxy via encoded path traversal |
High EPSS 0.52% |
< 0.9.6 | 0.9.6 |
| GHSA-cx9v-4qj2-jrw6 Open WebUI BOLA: `search_knowledge_files` Allows Unauthorized Knowledge Base File Enumeration |
Medium EPSS 0.30% |
< 0.9.6 | 0.9.6 |
| GHSA-cx9v-4qj2-jrw6 Open WebUI BOLA: `search_knowledge_files` Allows Unauthorized Knowledge Base File Enumeration |
Medium EPSS 0.30% |
< 0.9.6 | 0.9.6 |
| GHSA-4r4w-2wgp-w7cj Open WebUI Prompt history IDOR: unbound history_id allows cross-prompt read and deletion |
Medium EPSS 0.27% |
< 0.9.6 | 0.9.6 |
| GHSA-4r4w-2wgp-w7cj Open WebUI Prompt history IDOR: unbound history_id allows cross-prompt read and deletion |
Medium EPSS 0.27% |
< 0.9.6 | 0.9.6 |
| GHSA-j2c8-v969-8r5c Open WebUI: Sibling-Prefix Path Traversal via /cache/{path} |
Medium EPSS 0.36% |
< 0.9.6 | 0.9.6 |
| GHSA-j2c8-v969-8r5c Open WebUI: Sibling-Prefix Path Traversal via /cache/{path} |
Medium EPSS 0.36% |
< 0.9.6 | 0.9.6 |
| GHSA-v2qm-5wxj-qhj7 Open WebUI: Stored XSS to Account Takeover via Model Profile Images |
High EPSS 0.30% |
< 0.9.6 | 0.9.6 |
| GHSA-v2qm-5wxj-qhj7 Open WebUI: Stored XSS to Account Takeover via Model Profile Images |
High EPSS 0.30% |
< 0.9.6 | 0.9.6 |
| GHSA-vjqm-6gcc-62cr Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion |
High EPSS 0.33% |
< 0.9.6 | 0.9.6 |
| GHSA-vjqm-6gcc-62cr Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion |
High EPSS 0.33% |
< 0.9.6 | 0.9.6 |
| GHSA-v8qj-hxv7-mgvv Open WebUI: Stored XSS in Mermaid Markdown Preview |
Medium EPSS 0.34% |
< 0.9.6 | 0.9.6 |
| GHSA-v8qj-hxv7-mgvv Open WebUI: Stored XSS in Mermaid Markdown Preview |
Medium EPSS 0.34% |
< 0.9.6 | 0.9.6 |
| GHSA-vrhc-3fr6-pc3c Open WebUI: Forged chat-file link allows cross-user file read and deletion |
High EPSS 0.42% |
< 0.9.6 | 0.9.6 |
| GHSA-vrhc-3fr6-pc3c Open WebUI: Forged chat-file link allows cross-user file read and deletion |
High EPSS 0.42% |
< 0.9.6 | 0.9.6 |
| GHSA-wch8-mhj5-9frg Open WebUI: Cross-user file disclosure via /api/chat/completions image_url field |
Medium EPSS 0.38% |
< 0.9.6 | 0.9.6 |
| GHSA-wch8-mhj5-9frg Open WebUI: Cross-user file disclosure via /api/chat/completions image_url field |
Medium EPSS 0.38% |
< 0.9.6 | 0.9.6 |
| GHSA-226f-f24g-524w Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url` (incomplete-fix sibling of CVE-2026-45401) |
High EPSS 0.33% |
< 0.9.6 | 0.9.6 |
| GHSA-226f-f24g-524w Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url` (incomplete-fix sibling of CVE-2026-45401) |
High EPSS 0.33% |
< 0.9.6 | 0.9.6 |
| GHSA-3vv5-8xxp-4f55 Open WebUI: Cross-origin postMessage confirmation bypass via action:submit |
Medium EPSS 0.23% |
< 0.9.6 | 0.9.6 |
| GHSA-3vv5-8xxp-4f55 Open WebUI: Cross-origin postMessage confirmation bypass via action:submit |
Medium EPSS 0.23% |
< 0.9.6 | 0.9.6 |
| GHSA-f3g7-59qc-pqg6 Open WebUI IDOR: Calendar event re-parenting allows writing events into another user's calendar |
Medium EPSS 0.30% |
< 0.9.6 | 0.9.6 |
| GHSA-f3g7-59qc-pqg6 Open WebUI IDOR: Calendar event re-parenting allows writing events into another user's calendar |
Medium EPSS 0.30% |
< 0.9.6 | 0.9.6 |
| GHSA-h3ww-q6xx-w7x3 Open WebUI: LDAP and OAuth First-User Race Condition Allows Multiple Admin Accounts |
High EPSS 0.35% |
< 0.9.0 | 0.9.0 |
| GHSA-h3ww-q6xx-w7x3 Open WebUI: LDAP and OAuth First-User Race Condition Allows Multiple Admin Accounts |
High EPSS 0.35% |
< 0.9.0 | 0.9.0 |
| GHSA-482j-2pq6-q5w4 Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature gate bypassed |
High EPSS 0.41% |
< 0.8.12 | 0.8.12 |
| GHSA-482j-2pq6-q5w4 Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature gate bypassed |
High EPSS 0.41% |
< 0.8.12 | 0.8.12 |
| GHSA-26g9-27vm-x3q8 Open WebUI: shared-chat branch ignores access_type, allowing unauthorized file deletion |
High EPSS 0.27% |
< 0.9.0 | 0.9.0 |
| GHSA-26g9-27vm-x3q8 Open WebUI: shared-chat branch ignores access_type, allowing unauthorized file deletion |
High EPSS 0.27% |
< 0.9.0 | 0.9.0 |
| GHSA-m69w-p7m4-585j Open WebUI: Unauthenticated endpoint can trigger embedding generation (cost/DoS) |
Medium EPSS 0.34% |
< 0.8.0 | 0.8.0 |
| GHSA-m69w-p7m4-585j Open WebUI: Unauthenticated endpoint can trigger embedding generation (cost/DoS) |
Medium EPSS 0.34% |
< 0.8.0 | 0.8.0 |
| GHSA-x3qm-p8hr-3c3h Open WebUI has an Indirect Object Reference (IDOR) in user notes |
Medium EPSS 0.28% |
< 0.8.11 | 0.8.11 |
| GHSA-x3qm-p8hr-3c3h Open WebUI has an Indirect Object Reference (IDOR) in user notes |
Medium EPSS 0.28% |
< 0.8.11 | 0.8.11 |
| GHSA-r472-mw7m-967f Open WebUI: Cross-User File Access via Unchecked file_id in Folder Knowledge and Knowledge-Base Attach Endpoints |
High EPSS 0.35% |
< 0.9.5 | 0.9.5 |
| GHSA-r472-mw7m-967f Open WebUI: Cross-User File Access via Unchecked file_id in Folder Knowledge and Knowledge-Base Attach Endpoints |
High EPSS 0.35% |
< 0.9.5 | 0.9.5 |
| GHSA-3wgj-c2hg-vm6q Open WebUI vulnerable to stored XSS via OAuth picture claim stored as SVG data URI in profile_image_url |
High EPSS 0.64% |
< 0.9.5 | 0.9.5 |
| GHSA-rh5x-h6pp-cjj6 Open WebUI has a SSRF Bypass via HTTP Redirect Following in Web-Fetch and Image-Load Endpoints (not addressed by CVE-2025-65958) |
High EPSS 0.30% |
< 0.9.5 | 0.9.5 |
| GHSA-rh5x-h6pp-cjj6 Open WebUI has a SSRF Bypass via HTTP Redirect Following in Web-Fetch and Image-Load Endpoints (not addressed by CVE-2025-65958) |
High EPSS 0.30% |
< 0.9.5 | 0.9.5 |
| GHSA-8w7q-q5jp-jvgx Open WebUI has a Server-Side Request Forgery (SSRF) bypass in `validate_url` |
High EPSS 0.29% |
< 0.9.5 | 0.9.5 |
| GHSA-8w7q-q5jp-jvgx Open WebUI has a Server-Side Request Forgery (SSRF) bypass in `validate_url` |
High EPSS 0.29% |
< 0.9.5 | 0.9.5 |
| GHSA-8jjp-r2w2-4v22 Open WebUI: Low-privilege authenticated users can enumerate and stop global background tasks, causing system-wide chat disruption |
High EPSS 0.27% |
< 0.9.0 | 0.9.0 |
| GHSA-8jjp-r2w2-4v22 Open WebUI: Low-privilege authenticated users can enumerate and stop global background tasks, causing system-wide chat disruption |
High EPSS 0.27% |
< 0.9.0 | 0.9.0 |
| GHSA-4g37-7p2c-38r9 Open WebUI Vulnerable to IDOR: Retrieval API Bypasses Knowledge Base Access Controls |
High EPSS 0.33% |
< 0.9.5 | 0.9.5 |
| GHSA-4g37-7p2c-38r9 Open WebUI Vulnerable to IDOR: Retrieval API Bypasses Knowledge Base Access Controls |
High EPSS 0.33% |
< 0.9.5 | 0.9.5 |
| GHSA-65pg-qhhw-mxwg Open WebUI Vulnerable to Unauthenticated RAG Configuration Disclosure |
Medium EPSS 0.75% |
< 0.9.5 | 0.9.5 |
| GHSA-65pg-qhhw-mxwg Open WebUI Vulnerable to Unauthenticated RAG Configuration Disclosure |
Medium EPSS 0.75% |
< 0.9.5 | 0.9.5 |
| GHSA-rjmp-vjf2-qf4g Open WebUI: Mass Assignment via FeedbackForm extra=allow Allows Feedback User ID Spoofing and Evaluation Data Manipulation |
Medium EPSS 0.31% |
< 0.9.5 | 0.9.5 |
| GHSA-rjmp-vjf2-qf4g Open WebUI: Mass Assignment via FeedbackForm extra=allow Allows Feedback User ID Spoofing and Evaluation Data Manipulation |
Medium EPSS 0.31% |
< 0.9.5 | 0.9.5 |
| GHSA-h2cw-7qw9-56xr Open WebUI: Sharing models for others to use (read permission) also exposes model details (system prompt leakage) |
Medium EPSS 0.22% |
< 0.9.5 | 0.9.5 |
| GHSA-h2cw-7qw9-56xr Open WebUI: Sharing models for others to use (read permission) also exposes model details (system prompt leakage) |
Medium EPSS 0.22% |
< 0.9.5 | 0.9.5 |
| GHSA-5gc6-xhv4-2wg6 Open WebUI has an IDOR vulnerability in the pin_channel_message API endpoint |
Medium EPSS 0.27% |
< 0.9.5 | 0.9.5 |
| GHSA-5gc6-xhv4-2wg6 Open WebUI has an IDOR vulnerability in the pin_channel_message API endpoint |
Medium EPSS 0.27% |
< 0.9.5 | 0.9.5 |
| GHSA-wwhq-cx22-f7vv Open WebUI has an IDOR vulnerability in the update_message_by_id API endpoint |
Medium EPSS 0.25% |
< 0.9.5 | 0.9.5 |
| GHSA-wwhq-cx22-f7vv Open WebUI has an IDOR vulnerability in the update_message_by_id API endpoint |
Medium EPSS 0.25% |
< 0.9.5 | 0.9.5 |
| GHSA-v6qf-75pr-p96m Open WebUI: Authenticated users can bypass model access control via exposed query parameter [AI-ASSISTED] |
Medium EPSS 0.19% |
< 0.8.11 | 0.8.11 |
| GHSA-v6qf-75pr-p96m Open WebUI: Authenticated users can bypass model access control via exposed query parameter [AI-ASSISTED] |
Medium EPSS 0.19% |
< 0.8.11 | 0.8.11 |
| GHSA-jh9g-8jqw-m2qx Open WebUI Exposes System Prompt to Regular User [Non-Admin] |
Medium EPSS 0.28% |
< 0.8.9 | 0.8.9 |
| GHSA-jh9g-8jqw-m2qx Open WebUI Exposes System Prompt to Regular User [Non-Admin] |
Medium EPSS 0.28% |
< 0.8.9 | 0.8.9 |
| GHSA-4pcg-253r-rf9w Open WebUI's chat completion API allows tool restrictions to be bypassed |
High EPSS 0.27% |
< 0.8.6 | 0.8.6 |
| GHSA-4pcg-253r-rf9w Open WebUI's chat completion API allows tool restrictions to be bypassed |
High EPSS 0.27% |
< 0.8.6 | 0.8.6 |
| GHSA-gfm2-xm6c-37qc Open WebUI has Broken Access Control for Completions API |
High EPSS 0.23% |
< 0.9.0 | 0.9.0 |
| GHSA-gfm2-xm6c-37qc Open WebUI has Broken Access Control for Completions API |
High EPSS 0.23% |
< 0.9.0 | 0.9.0 |
| GHSA-f776-fp4w-266c Open WebUI vulnerable to blind server side request forgery (SSRF) via the PDF generate function |
Medium EPSS 0.19% |
< 0.5.11 | 0.5.11 |
| GHSA-f776-fp4w-266c Open WebUI vulnerable to blind server side request forgery (SSRF) via the PDF generate function |
Medium EPSS 0.19% |
< 0.5.11 | 0.5.11 |
| GHSA-gm54-m39w-grjp Open WebUI missing authorization check at the model update function - models from other users can be updated |
Medium EPSS 0.23% |
< 0.5.7 | 0.5.7 |
| GHSA-gm54-m39w-grjp Open WebUI missing authorization check at the model update function - models from other users can be updated |
Medium EPSS 0.23% |
< 0.5.7 | 0.5.7 |
| PYSEC-2026-3543 Open WebUI's API key endpoint restrictions bypassed via `x-api-key` header — full message processing on restricted endpoints |
Medium EPSS 0.31% |
< 0.9.0 | 0.9.0 |
| GHSA-24c9-2m8q-qhmh Open WebUI Vulnerable to SSRF via OAuth Profile Picture URL in _process_picture_url (oauth.py) |
High EPSS 0.40% |
< 0.9.0 | 0.9.0 |
| GHSA-24c9-2m8q-qhmh Open WebUI Vulnerable to SSRF via OAuth Profile Picture URL in _process_picture_url (oauth.py) |
High EPSS 0.40% |
< 0.9.0 | 0.9.0 |
| GHSA-4v7r-f4w8-8972 Open WebUI has a full SSRF Vulnerability in the RAG Web Search Feature |
High EPSS 0.29% |
< 0.9.0 | 0.9.0 |
| GHSA-4v7r-f4w8-8972 Open WebUI has a full SSRF Vulnerability in the RAG Web Search Feature |
High EPSS 0.29% |
< 0.9.0 | 0.9.0 |
| GHSA-j6w6-986j-2m2m Open WebUI Vulnerable to Cross-Site Request Forgery (CSRF) via Image URL Manipulation |
Medium EPSS 0.17% |
< 0.9.3 | 0.9.3 |
| GHSA-j6w6-986j-2m2m Open WebUI Vulnerable to Cross-Site Request Forgery (CSRF) via Image URL Manipulation |
Medium EPSS 0.17% |
< 0.9.3 | 0.9.3 |
| GHSA-hcwp-82g6-8wxc Open WebUI has stored XSS via unsanitized Office/Excel/DOCX file preview rendering ({@html} without DOMPurify) |
Medium EPSS 0.21% |
< 0.9.3 | 0.9.3 |
| GHSA-hcwp-82g6-8wxc Open WebUI has stored XSS via unsanitized Office/Excel/DOCX file preview rendering ({@html} without DOMPurify) |
Medium EPSS 0.21% |
< 0.9.3 | 0.9.3 |
| GHSA-jx2x-j75f-xq3j Open WebUI: Read-Only Users Can Toggle Note Pin Status via Incorrect Permission Check (Write via Read-Only Access) |
Low EPSS 0.24% |
< 0.9.3 | 0.9.3 |
| GHSA-jx2x-j75f-xq3j Open WebUI: Read-Only Users Can Toggle Note Pin Status via Incorrect Permission Check (Write via Read-Only Access) |
Low EPSS 0.24% |
< 0.9.3 | 0.9.3 |
| GHSA-3856-3vxq-m6fc Open WebUI has XSS via SVG in /api/v1/channels/webhooks/{webhook_id}/profile/image |
Medium EPSS 0.22% |
< 0.9.3 | 0.9.3 |
| GHSA-3856-3vxq-m6fc Open WebUI has XSS via SVG in /api/v1/channels/webhooks/{webhook_id}/profile/image |
Medium EPSS 0.22% |
< 0.9.3 | 0.9.3 |
| GHSA-m8f9-9whg-f4xr Open WebUI has stored XSS via attacker-controlled file extension in /api/v1/audio/transcriptions |
High EPSS 0.19% |
< 0.9.3 | 0.9.3 |
| GHSA-m8f9-9whg-f4xr Open WebUI has stored XSS via attacker-controlled file extension in /api/v1/audio/transcriptions |
High EPSS 0.19% |
< 0.9.3 | 0.9.3 |
| GHSA-4vrc-m9ch-6m3r Open WebUI has stored XSS via the HTML renedering view |
High EPSS 0.22% |
< 0.6.5 | 0.6.5 |
| GHSA-4vrc-m9ch-6m3r Open WebUI has stored XSS via the HTML renedering view |
High EPSS 0.22% |
< 0.6.5 | 0.6.5 |
| GHSA-r8wh-8m7r-fh33 Open WebUI: Missing permission check in files API allows authenticated users to list, access and delete every uploaded file |
High EPSS 0.27% |
< 0.3.16 | 0.3.16 |
| GHSA-r8wh-8m7r-fh33 Open WebUI: Missing permission check in files API allows authenticated users to list, access and delete every uploaded file |
High EPSS 0.27% |
< 0.3.16 | 0.3.16 |
| GHSA-6gh2-q7cp-9qf6 Open WebUI has Stored Cross-Site Scripting In Profile Picture |
Medium EPSS 0.20% |
< 0.8.0 | 0.8.0 |
| GHSA-6gh2-q7cp-9qf6 Open WebUI has Stored Cross-Site Scripting In Profile Picture |
Medium EPSS 0.20% |
< 0.8.0 | 0.8.0 |
| GHSA-hmjq-crxp-7rjw Open WebUI has inconsistent authorization controls within memories API |
High EPSS 0.29% |
< 0.6.19 | 0.6.19 |
| GHSA-hmjq-crxp-7rjw Open WebUI has inconsistent authorization controls within memories API |
High EPSS 0.29% |
< 0.6.19 | 0.6.19 |
| GHSA-jgj3-r8hr-9pjw Open WebUI's Improper Authorization in Standard Channels Allows Message Updates with Read Permission |
Medium EPSS 0.28% |
< 0.8.6 | 0.8.6 |
| GHSA-jgj3-r8hr-9pjw Open WebUI's Improper Authorization in Standard Channels Allows Message Updates with Read Permission |
Medium EPSS 0.28% |
< 0.8.6 | 0.8.6 |
| GHSA-jxwr-g6r6-j3fx Open WebUI's Insecure Message Access Breaks Authorization |
High EPSS 0.27% |
< 0.6.19 | 0.6.19 |
| GHSA-jxwr-g6r6-j3fx Open WebUI's Insecure Message Access Breaks Authorization |
High EPSS 0.27% |
< 0.6.19 | 0.6.19 |
| GHSA-j3fw-wc48-29g3 Open WebUI Arbitrary File Write, Delete via Path Traversal |
High EPSS 0.45% |
< 0.6.10 | 0.6.10 |
| GHSA-j3fw-wc48-29g3 Open WebUI Arbitrary File Write, Delete via Path Traversal |
High EPSS 0.45% |
< 0.6.10 | 0.6.10 |
| GHSA-6xcp-7mpr-m7wm Open WebUI has a CORS misconfiguration and session validation issue |
Critical EPSS 0.52% |
< 0.3.33 | 0.3.33 |
| GHSA-9pgh-j74g-qj6m Open WebUI Vulnerable to Arbitrary File Upload and Path Traversal |
Critical EPSS 0.34% |
< 0.1.124 | 0.1.124 |
| GHSA-9pgh-j74g-qj6m Open WebUI Vulnerable to Arbitrary File Upload and Path Traversal |
Critical EPSS 0.34% |
< 0.1.124 | 0.1.124 |
| GHSA-4vg5-rp28-gvjf Open WebUI has Improper Authorization Control |
High EPSS 0.23% |
< 0.1.124 | 0.1.124 |
| GHSA-4vg5-rp28-gvjf Open WebUI has Improper Authorization Control |
High EPSS 0.23% |
< 0.1.124 | 0.1.124 |
| GHSA-jwf8-pv5p-vhmc Open WebUI has stored XSS in Excel file preview |
High EPSS 0.32% |
< 0.8.0 | 0.8.0 |
| GHSA-jwf8-pv5p-vhmc Open WebUI has stored XSS in Excel file preview |
High EPSS 0.32% |
< 0.8.0 | 0.8.0 |
| GHSA-fq3v-xjjx-95rc Open WebUI has Stored XSS in Pending User Overlay via Incorrect DOMPurify Application Order |
Medium EPSS 0.17% |
< 0.9.0 | 0.9.0 |
| GHSA-fq3v-xjjx-95rc Open WebUI has Stored XSS in Pending User Overlay via Incorrect DOMPurify Application Order |
Medium EPSS 0.17% |
< 0.9.0 | 0.9.0 |
| GHSA-h36f-rqpx-j5wx Open WebUI has Unauthorized File and Knowledge Base Content Access via RAG Vector Search |
Medium EPSS 0.37% |
< 0.9.0 | 0.9.0 |
| GHSA-h36f-rqpx-j5wx Open WebUI has Unauthorized File and Knowledge Base Content Access via RAG Vector Search |
Medium EPSS 0.37% |
< 0.9.0 | 0.9.0 |
| GHSA-hmgr-67hw-j2cq Open WebUI: Deactivated Channel Members Retain Full Access to Group/DM Channels |
Medium EPSS 0.18% |
< 0.9.0 | 0.9.0 |
| GHSA-hmgr-67hw-j2cq Open WebUI: Deactivated Channel Members Retain Full Access to Group/DM Channels |
Medium EPSS 0.18% |
< 0.9.0 | 0.9.0 |
| GHSA-vrfh-rj4q-rmhr Read-Only Open WebUI Users Can Modify Collaborative Documents via Socket.IO |
Medium EPSS 0.22% |
< 0.9.0 | 0.9.0 |
| GHSA-vrfh-rj4q-rmhr Read-Only Open WebUI Users Can Modify Collaborative Documents via Socket.IO |
Medium EPSS 0.22% |
< 0.9.0 | 0.9.0 |
| GHSA-rcvp-6fgw-c7fh Open WebUI's Ollama Model Access Control Bypass via /api/generate, /api/embed, /api/embeddings, and /api/show |
Medium EPSS 0.24% |
< 0.9.0 | 0.9.0 |
| GHSA-rcvp-6fgw-c7fh Open WebUI's Ollama Model Access Control Bypass via /api/generate, /api/embed, /api/embeddings, and /api/show |
Medium EPSS 0.24% |
< 0.9.0 | 0.9.0 |
| GHSA-mqq6-cqcx-38vg Open WebUI's Model Import Overwrites Any Model Without Ownership Check |
Medium EPSS 0.29% |
< 0.9.0 | 0.9.0 |
| GHSA-mqq6-cqcx-38vg Open WebUI's Model Import Overwrites Any Model Without Ownership Check |
Medium EPSS 0.29% |
< 0.9.0 | 0.9.0 |
| GHSA-c7wp-3qh5-55pv Open WebUI Missing Access Check on Channel Members Endpoint for Standard Channels |
Medium EPSS 0.22% |
< 0.9.0 | 0.9.0 |
| GHSA-c7wp-3qh5-55pv Open WebUI Missing Access Check on Channel Members Endpoint for Standard Channels |
Medium EPSS 0.22% |
< 0.9.0 | 0.9.0 |
| GHSA-6c2x-gcp3-gp73 Open WebUI vulnerable to Global Knowledge Base Enumeration via knowledge-bases Meta-Collection |
Medium EPSS 0.22% |
< 0.9.0 | 0.9.0 |
| GHSA-6c2x-gcp3-gp73 Open WebUI vulnerable to Global Knowledge Base Enumeration via knowledge-bases Meta-Collection |
Medium EPSS 0.22% |
< 0.9.0 | 0.9.0 |
| GHSA-7r82-qhg4-6wvj Open WebUI has Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection Overwrite |
High EPSS 0.29% |
< 0.9.0 | 0.9.0 |
| GHSA-7r82-qhg4-6wvj Open WebUI has Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection Overwrite |
High EPSS 0.29% |
< 0.9.0 | 0.9.0 |
| GHSA-7rjh-px4v-5w55 Open WebUI's Channel Access Grants Bypass filter_allowed_access_grants |
Medium EPSS 0.19% |
< 0.9.0 | 0.9.0 |
| GHSA-7rjh-px4v-5w55 Open WebUI's Channel Access Grants Bypass filter_allowed_access_grants |
Medium EPSS 0.19% |
< 0.9.0 | 0.9.0 |
| GHSA-hp5m-24vp-vq2q Open WebUI's responses passthrough endpoint lacks access control authorization |
High EPSS 0.31% |
< 0.9.0 | 0.9.0 |
| GHSA-hp5m-24vp-vq2q Open WebUI's responses passthrough endpoint lacks access control authorization |
High EPSS 0.31% |
< 0.9.0 | 0.9.0 |
| GHSA-9vvh-qmjx-p4q8 Open WebUI's Base Model Routing Bypasses Access Control via Model Chaining |
High EPSS 0.30% |
< 0.9.0 | 0.9.0 |
| GHSA-9vvh-qmjx-p4q8 Open WebUI's Base Model Routing Bypasses Access Control via Model Chaining |
High EPSS 0.30% |
< 0.9.0 | 0.9.0 |
| GHSA-3x8w-4f7p-xxc2 Open WebUI: Redis Cache Keys tool_servers and terminal_servers Missing Instance Prefix Enable Cross-Instance Cache Poisoning |
High EPSS 0.30% |
< 0.9.0 | 0.9.0 |
| GHSA-3x8w-4f7p-xxc2 Open WebUI: Redis Cache Keys tool_servers and terminal_servers Missing Instance Prefix Enable Cross-Instance Cache Poisoning |
High EPSS 0.30% |
< 0.9.0 | 0.9.0 |
| GHSA-45m8-cpm2-3v65 Open WebUI: Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access |
High EPSS 0.28% |
< 0.9.0 | 0.9.0 |
| GHSA-45m8-cpm2-3v65 Open WebUI: Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access |
High EPSS 0.28% |
< 0.9.0 | 0.9.0 |
| GHSA-hr43-rjmr-7wmm Open WebUI's Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users' Accounts |
Medium EPSS 0.29% |
< 0.9.0 | 0.9.0 |
| GHSA-hr43-rjmr-7wmm Open WebUI's Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users' Accounts |
Medium EPSS 0.29% |
< 0.9.0 | 0.9.0 |
| GHSA-2r4p-jpmg-48f4 Open WebUI has an LDAP Empty Password Authentication Bypass |
Critical EPSS 1.46% |
< 0.9.0 | 0.9.0 |
| GHSA-2r4p-jpmg-48f4 Open WebUI has an LDAP Empty Password Authentication Bypass |
Critical EPSS 1.46% |
< 0.9.0 | 0.9.0 |
| GHSA-gf5m-wcrh-7928 open-webui Vulnerable to Stored XSS via Model Description |
High EPSS 0.31% |
< 0.9.0 | 0.9.0 |
| GHSA-gf5m-wcrh-7928 open-webui Vulnerable to Stored XSS via Model Description |
High EPSS 0.31% |
< 0.9.0 | 0.9.0 |
| GHSA-jgx9-jr5x-mvpv Open WebUI has Blind Server Side Request Forgery in its Image Edit Functionality |
Medium EPSS 0.29% |
<= 0.7.2 | No fix yet |
| GHSA-jgx9-jr5x-mvpv Open WebUI has Blind Server Side Request Forgery in its Image Edit Functionality |
Medium EPSS 0.29% |
<= 0.7.2 | No fix yet |
| GHSA-7429-hxcv-268m Open WebUI has Broken Access Control in Tool Valves |
High EPSS 5.10% |
< 0.8.11 | 0.8.11 |
| GHSA-7429-hxcv-268m Open WebUI has Broken Access Control in Tool Valves |
High EPSS 5.10% |
< 0.8.11 | 0.8.11 |
| GHSA-w9f8-gxf9-rhvw Open WebUI's Insecure Direct Object Reference (IDOR) allows access to other users' memories |
Medium EPSS 0.26% |
< 0.8.6 | 0.8.6 |
| GHSA-w9f8-gxf9-rhvw Open WebUI's Insecure Direct Object Reference (IDOR) allows access to other users' memories |
Medium EPSS 0.26% |
< 0.8.6 | 0.8.6 |
| GHSA-26gm-93rw-cchf Open WebUI has unauthorized deletion of knowledge files |
High EPSS 0.26% |
< 0.8.6 | 0.8.6 |
| GHSA-26gm-93rw-cchf Open WebUI has unauthorized deletion of knowledge files |
High EPSS 0.26% |
< 0.8.6 | 0.8.6 |
| GHSA-jjp7-g2jw-wh3j Open WebUI's process_files_batch() endpoint missing ownership check, allows unauthorized file overwrite |
High EPSS 2.97% |
< 0.8.6 | 0.8.6 |
| GHSA-jjp7-g2jw-wh3j Open WebUI's process_files_batch() endpoint missing ownership check, allows unauthorized file overwrite |
High EPSS 2.97% |
< 0.8.6 | 0.8.6 |
| GHSA-vvxm-vxmr-624h Open WebUI vulnerable to Path Traversal in `POST /api/v1/audio/transcriptions` |
Medium EPSS 0.57% |
< 0.8.6 | 0.8.6 |
| GHSA-vvxm-vxmr-624h Open WebUI vulnerable to Path Traversal in `POST /api/v1/audio/transcriptions` |
Medium EPSS 0.57% |
< 0.8.6 | 0.8.6 |
| GHSA-2rf6-9rc8-rqch Withdrawn Advisory: Open WebUI JWT Key Handler Withdrawn |
Low | <= 0.6.16 | No fix yet |
| GHSA-vjm7-m4xh-7wrc Open WebUI vulnerable to Stored XSS via iFrame embeds in response messages |
Medium EPSS 0.23% |
< 0.6.44 | 0.6.44 |
| GHSA-vjm7-m4xh-7wrc Open WebUI vulnerable to Stored XSS via iFrame embeds in response messages |
Medium EPSS 0.23% |
< 0.6.44 | 0.6.44 |
| GHSA-xc8p-9rr6-97r2 Open WebUI vulnerable to Stored XSS via iFrame in citations model |
Medium EPSS 0.23% |
< 0.7.0 | 0.7.0 |
| GHSA-xc8p-9rr6-97r2 Open WebUI vulnerable to Stored XSS via iFrame in citations model |
Medium EPSS 0.23% |
< 0.7.0 | 0.7.0 |
| GHSA-vh96-p962-544h Withdrawn Advisory: Open WebUI/ZDI-CAN-28259 Withdrawn |
Medium | <= 0.6.33 | No fix yet |
| GHSA-c6xv-rcvw-v685 Open WebUI vulnerable to Server-Side Request Forgery (SSRF) via Arbitrary URL Processing in /api/v1/retrieval/process/web |
High EPSS 4.43% |
< 0.6.37 | 0.6.37 |
| GHSA-c6xv-rcvw-v685 Open WebUI vulnerable to Server-Side Request Forgery (SSRF) via Arbitrary URL Processing in /api/v1/retrieval/process/web |
High EPSS 4.43% |
< 0.6.37 | 0.6.37 |
| GHSA-frv8-gffc-37px open-webui is Vulnerable to Incorrect Access Control |
Medium EPSS 0.28% |
< 0.9.0 | 0.9.0 |
| GHSA-frv8-gffc-37px open-webui is Vulnerable to Incorrect Access Control |
Medium EPSS 0.28% |
<= 0.6.33 | No fix yet |
| GHSA-cm35-v4vp-5xvx Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events |
High EPSS 7.23% |
< 0.6.35 | 0.6.35 |
| GHSA-cm35-v4vp-5xvx Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events |
High EPSS 7.23% |
< 0.6.35 | 0.6.35 |
| GHSA-w7xj-8fx7-wfch Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE |
Medium EPSS 0.49% |
< 0.6.35 | 0.6.35 |
| GHSA-w7xj-8fx7-wfch Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE |
Medium EPSS 0.49% |
< 0.6.35 | 0.6.35 |
| GHSA-9f4f-jv96-8766 Open WebUI vulnerable to stored XSS via unescaped markdown token in MarkdownTokens.svelte leading to full account takeover and RCE via functions |
Medium EPSS 0.58% |
< 0.6.6 | 0.6.6 |
| GHSA-9f4f-jv96-8766 Open WebUI vulnerable to stored XSS via unescaped markdown token in MarkdownTokens.svelte leading to full account takeover and RCE via functions |
Medium EPSS 0.58% |
< 0.6.6 | 0.6.6 |
| GHSA-8gh5-qqh8-hq3x Open WebUI allows limited stored XSS vila uploaded html file |
Medium EPSS 0.37% |
< 0.6.6 | 0.6.6 |
| GHSA-8gh5-qqh8-hq3x Open WebUI allows limited stored XSS vila uploaded html file |
Medium EPSS 0.37% |
< 0.6.6 | 0.6.6 |
| GHSA-5ccf-884p-4jjq Open WebUI Unauthenticated Multipart Boundary Denial of Service (DoS) Vulnerability |
High | <= 0.3.21 | No fix yet |
| GHSA-6wj5-5pgr-jwq8 Open WebUI Unauthenticated Multipart Boundary Denial of Service (DoS) Vulnerability in api/chat/file |
High | < 0.4.7 | 0.4.7 |
| GHSA-w466-2wfc-8g58 Open WebUI has vulnerable dependency on starlette via fastapi |
High | < 0.5.8 | 0.5.8 |
| GHSA-ff5c-56m7-vc75 Open WebUI allows Remote Code Execution via Arbitrary File Upload to /audio/api/v1/transcriptions |
High | < 0.5.17 | 0.5.17 |
| GHSA-ff5c-56m7-vc75 Open WebUI allows Remote Code Execution via Arbitrary File Upload to /audio/api/v1/transcriptions |
High | < 0.5.17 | 0.5.17 |
| GHSA-9vf8-xgwm-97r8 Open WebUI lacks authentication for the `api/v1/utils/pdf` endpoint |
High EPSS 0.65% |
< 0.5.13 | 0.5.13 |
| GHSA-9vf8-xgwm-97r8 Open WebUI lacks authentication for the `api/v1/utils/pdf` endpoint |
High EPSS 0.65% |
<= 0.3.10 | No fix yet |
| GHSA-gj27-76gq-5v3p Open WebUI stored cross-site scripting (XSS) vulnerability |
High | <= 0.3.8 | No fix yet |
| GHSA-gj27-76gq-5v3p Open WebUI stored cross-site scripting (XSS) vulnerability |
High | <= 0.3.8 | No fix yet |
| GHSA-5v9m-57mq-qc75 Open WebUI denial of service through endpoint for converting markdown |
High EPSS 0.88% |
< 0.5.13 | 0.5.13 |
| GHSA-5v9m-57mq-qc75 Open WebUI denial of service through endpoint for converting markdown |
High EPSS 0.88% |
<= 0.3.8 | No fix yet |
| GHSA-x757-hv69-jr45 Withdrawn Advisory: Open WebUI has SSRF in /openai/models Withdrawn |
High | <= 0.3.8 | No fix yet |
| GHSA-x757-hv69-jr45 Withdrawn Advisory: Open WebUI has SSRF in /openai/models Withdrawn |
High | <= 0.3.8 | No fix yet |
| GHSA-85jc-8h5p-8vw8 Open WebUI Cross-Site Request Forgery (CSRF) Vulnerability |
High | < 0.3.33 | 0.3.33 |
| GHSA-85jc-8h5p-8vw8 Open WebUI Cross-Site Request Forgery (CSRF) Vulnerability |
High | < 0.3.33 | 0.3.33 |
| GHSA-43g4-487m-5q6m Open WebUI Vulnerable to a Session Fixation Attack |
High | <= 0.3.8 | No fix yet |
| GHSA-43g4-487m-5q6m Open WebUI Vulnerable to a Session Fixation Attack |
High | <= 0.3.8 | No fix yet |
| GHSA-gv26-qw3h-8qvp Open WebUI Allows Viewing of Admin Details |
Medium | <= 0.3.8 | No fix yet |
| GHSA-gv26-qw3h-8qvp Open WebUI Allows Viewing of Admin Details |
Medium | <= 0.3.8 | No fix yet |
| GHSA-c7fq-p62p-wvpc Open WebUI Has Improper Access Control Leading to Arbitrary Prompt Read |
Medium | <= 0.3.8 | No fix yet |
| GHSA-c7fq-p62p-wvpc Open WebUI Has Improper Access Control Leading to Arbitrary Prompt Read |
Medium | <= 0.3.8 | No fix yet |
| GHSA-j274-m559-cj4j Open WebUI Vulnerable to Cross-Site Scripting (XSS) via Chat File Upload |
High EPSS 0.53% |
< 0.3.33 | 0.3.33 |
| GHSA-j274-m559-cj4j Open WebUI Vulnerable to Cross-Site Scripting (XSS) via Chat File Upload |
High EPSS 0.53% |
<= 0.3.8 | No fix yet |
| GHSA-jrhc-9qg9-4qfq Open WebUI Allows Arbitrary File Reading and Deletion |
High EPSS 0.61% |
<= 0.3.8 | No fix yet |
| GHSA-jrhc-9qg9-4qfq Open WebUI Allows Arbitrary File Reading and Deletion |
High EPSS 0.61% |
< 0.3.16 | 0.3.16 |
| GHSA-cfvq-fj53-j2c7 Withdrawn Advisory: Open WebUI Access Control Withdrawn |
Medium | <= 0.3.8 | No fix yet |
| GHSA-pqwr-phvv-v49f Withdrawn Advisory: Open WebUI Allows Admin Deletion via API Endpoint Withdrawn |
High | <= 0.3.8 | No fix yet |
| GHSA-pqwr-phvv-v49f Withdrawn Advisory: Open WebUI Allows Admin Deletion via API Endpoint Withdrawn |
High | <= 0.3.8 | No fix yet |
| GHSA-wcwp-9rcp-jvfg Open WebUI Uncontrolled Resource Consumption vulnerability |
High | <= 0.3.8 | No fix yet |
| GHSA-wcwp-9rcp-jvfg Open WebUI Uncontrolled Resource Consumption vulnerability |
High | <= 0.3.8 | No fix yet |
| GHSA-p5vx-9hj8-cf4h Open WebUI Vulnerable to Cross-Site Request Forgery (CSRF) |
Medium EPSS 8.67% |
< 0.3.16 | 0.3.16 |
| GHSA-p5vx-9hj8-cf4h Open WebUI Vulnerable to Cross-Site Request Forgery (CSRF) |
Medium EPSS 8.67% |
<= 0.3.8 | No fix yet |
| GHSA-crh6-pj8c-xrhc Withdrawn Advisory: Open WebUI Allows Arbitrary File Write via the `/models/upload` Endpoint Withdrawn |
Medium | <= 0.3.8 | No fix yet |
| GHSA-crh6-pj8c-xrhc Withdrawn Advisory: Open WebUI Allows Arbitrary File Write via the `/models/upload` Endpoint Withdrawn |
Medium | <= 0.3.8 | No fix yet |
| GHSA-3p9q-7w63-3f8q Withdrawn Advisory: Open WebUI Allows Arbitrary File Write via the `download_model` Endpoint Withdrawn |
Medium | <= 0.3.8 | No fix yet |
| GHSA-3p9q-7w63-3f8q Withdrawn Advisory: Open WebUI Allows Arbitrary File Write via the `download_model` Endpoint Withdrawn |
Medium | <= 0.3.8 | No fix yet |
| GHSA-chf7-q7m5-fq92 Open WebUI Uncontrolled Resource Consumption vulnerability |
High | <= 0.3.32 | No fix yet |
| GHSA-chf7-q7m5-fq92 Open WebUI Uncontrolled Resource Consumption vulnerability |
High | <= 0.3.32 | No fix yet |
| GHSA-g3mx-83mp-3rwc Open WebUI Uncontrolled Resource Consumption vulnerability |
High | <= 0.3.32 | No fix yet |
| GHSA-g3mx-83mp-3rwc Open WebUI Uncontrolled Resource Consumption vulnerability |
High | <= 0.3.32 | No fix yet |
| GHSA-xcvc-5hgv-phqg open-webui Insecure Direct Object Reference (IDOR) vulnerability |
Medium EPSS 0.37% |
< 0.6.3 | 0.6.3 |
| GHSA-xcvc-5hgv-phqg open-webui Insecure Direct Object Reference (IDOR) vulnerability |
Medium EPSS 0.37% |
< 0.6.3 | 0.6.3 |
| GHSA-54f4-v6v9-9q82 open-webui allows writing and deleting arbitrary files |
Medium | <= 0.3.8 | No fix yet |
| GHSA-54f4-v6v9-9q82 open-webui allows writing and deleting arbitrary files |
Medium | <= 0.3.8 | No fix yet |
| GHSA-mq92-jr35-ffpc Withdrawn Advisory: open-webui allows enumeration of file names and traversal of directories by observing the error messages Withdrawn |
Low | <= 0.3.8 | No fix yet |
| GHSA-mq92-jr35-ffpc Withdrawn Advisory: open-webui allows enumeration of file names and traversal of directories by observing the error messages Withdrawn |
Low | <= 0.3.8 | No fix yet |
| GHSA-5jp3-wp5v-5363 Open WebUI Stored Cross-Site Scripting Vulnerability |
Medium EPSS 0.66% |
< 0.3.14 | 0.3.14 |
| GHSA-5jp3-wp5v-5363 Open WebUI Stored Cross-Site Scripting Vulnerability |
Medium EPSS 0.66% |
< 0.3.14 | 0.3.14 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor